[Slackbuilds-users] Source Downloads

[Arkadiusz Drabczyk]

On 2016-07-26, Andrzej Telszewski <atelszewski at gmail.com> wrote:
> On 26/07/16 23:44, Arkadiusz Drabczyk wrote:
>> On 2016-07-26, Robby Workman <rworkman at slackbuilds.org> wrote:
>>>> academic/wmcalc
>>>> md5sum is  f6b432b81d06a9cb538255ca0adcf03e
>>>> instead of ab62320662b38475a6882844266ad032
>>>
>>>
>>> This is insane.
>>>
>>> Download with wget:
>>> 13dfb83473b4fe5683375f537aba5fe0  c2f0ad2882b89c5c33dfb8331c1f05ca284e7c36.=
>>> tar.gz
>>>
>>> Download with browser:
>>> a6c5367acd477d433372a59af3d61ed3  dockapps-c2f0ad2.tar.gz
>>>
>>> Download with lftpget:
>>> a30fda4c3b6bb65a00a6dae9170fc3aa  c2f0ad2882b89c5c33dfb8331c1f05ca284e7c36.=
>>> tar.gz
>>>
>>> Screw this. It can stay broken or someone else can do=20
>>> something with it.
>>
>> I get a different MD5 every time I download this file, it doesn't
>> matter if I use Firefox, wget or curl.  Only first few bytes and some
>> bytes later in the file are the same in all downloaded files and the
>> first two bytes are 0x1f8b which is a correct magic number for tar.gz
>> files.  What is interesting all these files contain the same files
>> with the same MD5 sums.  I guess that the server somehow modifies the
>> tarballs before sending them.  Wget with --save-headers says that
>> repo.or.cz is served by Apache so they may run a modified version of
>> Apache or use a plugin.
>>
>> I'd like to know what's going on here too.
>>
>
> My guess is that they're creating the tarball on the fly and each time 
> they're modifying archived files time stamps. I haven't checked it, though.

I just checked it and it seems that you're right.  In such case I
think we should put this tarball to an external server so that its MD5
sum stays the same.
-- 
Arkadiusz Drabczyk <arkadiusz at drabczyk.org>