[Slackbuilds-users] Source Downloads

[Andrzej Telszewski]

On 26/07/16 23:44, Arkadiusz Drabczyk wrote:
> On 2016-07-26, Robby Workman <rworkman at slackbuilds.org> wrote:
>>> academic/wmcalc
>>> md5sum is  f6b432b81d06a9cb538255ca0adcf03e
>>> instead of ab62320662b38475a6882844266ad032
>>
>>
>> This is insane.
>>
>> Download with wget:
>> 13dfb83473b4fe5683375f537aba5fe0  c2f0ad2882b89c5c33dfb8331c1f05ca284e7c36.=
>> tar.gz
>>
>> Download with browser:
>> a6c5367acd477d433372a59af3d61ed3  dockapps-c2f0ad2.tar.gz
>>
>> Download with lftpget:
>> a30fda4c3b6bb65a00a6dae9170fc3aa  c2f0ad2882b89c5c33dfb8331c1f05ca284e7c36.=
>> tar.gz
>>
>> Screw this. It can stay broken or someone else can do=20
>> something with it.
>
> I get a different MD5 every time I download this file, it doesn't
> matter if I use Firefox, wget or curl.  Only first few bytes and some
> bytes later in the file are the same in all downloaded files and the
> first two bytes are 0x1f8b which is a correct magic number for tar.gz
> files.  What is interesting all these files contain the same files
> with the same MD5 sums.  I guess that the server somehow modifies the
> tarballs before sending them.  Wget with --save-headers says that
> repo.or.cz is served by Apache so they may run a modified version of
> Apache or use a plugin.
>
> I'd like to know what's going on here too.
>

My guess is that they're creating the tarball on the fly and each time 
they're modifying archived files time stamps. I haven't checked it, though.

-- 
Best regards,
Andrzej Telszewski