https://buildd.debian.org/status/logs.php?pkg=golang-github-grpc-ecosystem-go-grpc-middleware&ver=1.3.0-1&arch=all&suite=experimental

The three Maybe-Failed until November 3rd at the bottom are normal FTBFS.

But the Maybe-Given-back since yesterday are:

...
Get:1 https://deb.debian.org/debian experimental/main golang-github-grpc-ecosystem-go-grpc-middleware 1.3.0-1 (dsc) [2857 B]
Err:1 https://deb.debian.org/debian experimental/main golang-github-grpc-ecosystem-go-grpc-middleware 1.3.0-1 (dsc)
  Hash Sum mismatch
  Hashes of expected file:
   - SHA256:8e86e0a9cc31461c0f564e8feefb2e1e9ec05c265ab06e96fd32b7de787bc504
   - Filesize:2857 [weak]
   - MD5Sum:c4d33ab09e4f4a95c819dd1de88d0876 [weak]
  Hashes of received file:
   - SHA256:8bbee530bbdb11a58a275c34878c372558223c294384897822eba1338b84db82
   - MD5Sum:8d6eee1b2b773c9be12536396ba949a6 [weak]
   - Filesize:2857 [weak]
  Last modification reported: Wed, 26 Oct 2022 14:32:16 +0000
Get:2 https://deb.debian.org/debian experimental/main golang-github-grpc-ecosystem-go-grpc-middleware 1.3.0-1 (tar) [104 kB]
Get:3 https://deb.debian.org/debian experimental/main golang-github-grpc-ecosystem-go-grpc-middleware 1.3.0-1 (diff) [2652 B]
E: Failed to fetch https://deb.debian.org/debian/pool/main/g/golang-github-grpc-ecosystem-go-grpc-middleware/golang-github-grpc-ecosystem-go-grpc-middleware_1.3.0-1.dsc  Hash Sum mismatch
   Hashes of expected file:
    - SHA256:8e86e0a9cc31461c0f564e8feefb2e1e9ec05c265ab06e96fd32b7de787bc504
    - Filesize:2857 [weak]
   Fetched 109 kB in 0s (416 kB/s)
 - MD5Sum:c4d33ab09e4f4a95c819dd1de88d0876 [weak]
   Hashes of received file:
    - SHA256:8bbee530bbdb11a58a275c34878c372558223c294384897822eba1338b84db82
    - MD5Sum:8d6eee1b2b773c9be12536396ba949a6 [weak]
    - Filesize:2857 [weak]
   Last modification reported: Wed, 26 Oct 2022 14:32:16 +0000
E: Failed to fetch some archives.
E: apt-get for sources failed
...


I can reproduce the problem locally with
$ apt-get source golang-github-grpc-ecosystem-go-grpc-middleware/experimental

This is not supposed to happen, and I haven't seen this before.

Get:1 https://deb.debian.org/debian experimental/main golang-github-

So far as I can tell, the timeline is:

- 2022-10-26 package is uploaded
- 2022-10-31 package is removed as obsolete
- 2022-11-03 the same package is re-uploaded, with a different GPG
signature

The file in the archive matches the "expected" hashes, whereas deb.d.o
is returning the original file.

Regards,

Adam

Adrian Bunk <bunk@debian.org> (2022-11-10):

Yeah, the dsc seems to have changed, deb.debian.org returns the old version
(due to corporate-grade caching or whatever), while my local mirror (standard
apache2 serving files synced by ftpsync via syncproxy2.eu.debian.org and
debian.ethz.ch) shows the new version (which matches the Sources file and
downloads fine accordingly).

An extra check can be done by querying snapshot.debian.org, and `debsnap
golang-github-grpc-ecosystem-go-grpc-middleware 1.3.0-1` downloads
the old version as well.

An extra hint is obtained by clicking the 1.3.0-1 link on
<http://snapshot.debian.org/package/golang-github-grpc-ecosystem-go-grpc-middleware/>
and getting an error page, I suppose because of a different lookup
implementation.

Adding `-v` to the debsnap line above, I'm getting this URL:
https://snapshot.debian.org/mr/package/golang-github-grpc-ecosystem-go-grpc-middleware/1.3.0-1/srcfiles?fileinfo=1

which indeed has two `fileinfo` entries for the .dsc:

    "0feb631739624059c1db234338e87a57d33f4d5f": [
      {
        "archive_name": "debian",
        "first_seen": "20221027T213940Z",
        "name": "golang-github-grpc-ecosystem-go-grpc-middleware_1.3.0-1.dsc",
        "path": "/pool/main/g/golang-github-grpc-ecosystem-go-grpc-middleware",
        "size": 2857
      }
    ],
    "48d5553979d3de93b05587668ce30305d3ad9141": [
      {
        "archive_name": "debian",
        "first_seen": "20221103T151306Z",
        "name": "golang-github-grpc-ecosystem-go-grpc-middleware_1.3.0-1.dsc",
        "path": "/pool/main/g/golang-github-grpc-ecosystem-go-grpc-middleware",
        "size": 2857
      }
    ],

Maybe that'll help pinpoint what happened and/or when.


Cheers,